CVE-2026-59241CWE-266

CVE-2026-59241

High · published October 13, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
41.9
In the wild
Unconfirmed
What it is

A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7). The affected application does not sufficiently restrict the permissions assigned to a database role.

This could allow an authenticated remote attacker with database access to escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed, potentially leading to a compromise of the system.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00499 · 41.9th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2026-10-13T14:17Z
References (1)
https://cert-portal.siemens.com/productcert/html/ssa-550198.html · [email protected]
EPSS history
Timeline
  • 15 OCT 03:33Z
    EPSS moved — → 0%
    epss
  • 13 OCT 09:18Z
    A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions…
    cvelistv5
  • 13 OCT 09:18Z
    A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions…
    cvelistv5